使用Terraform时如何查询2个不同的Azure目录？

Question

I am configuring my infrastructure in one Azure Directory with terraform and so I have set the Azure CLI to use that subscription:

az account set --subscription xxxxxxxx-0000-xxxx-YYYY-zzzzzzzzzzzz

Part of the setup is to add Active Directory Groups to APIM Management.

I create the groups and query AD for their ids using az cli in local-exec .

However, Active Directory is in a different subscription to where the infrastructure is being created so this step fails.

How can I switch directory/subscription for this one call?

Answer 1

I create the groups and query AD for their ids using az cli in local-exec.

You can query for groups with datasource azuread_group and/or manage resource azuread_group instead of az cli .

To use datasource/resource with multiple subscriptions you should authenticate multiple providers with aliases with different subscription_id like that:

provider "azuread" {
  subscription_id = "xxxxxxxx-0000-xxxx-YYYY-zzzzzzzzzzzz"
}

provider "azuread" {
  subscription_id = "another-subscription-id"
  alias           = "custom"
}

resource "azurerm_api_management" "test" {
...
}

resource "azuread_group" "mygroup" {
  provider = azuread.custom
  name     = "my-group"
}